# SQL Injection Stacked Statement in LLM-Generated Query Execution

- **Severity:** Medium
- **Signature ID:** `7f3c1d2e-9b4a-4a61-8f0d-2c5e7a9b6d31`
- **CVEs:** CVE-2024-7764
- **OWASP:** LLM05 (Improper Output Handling)

## Summary

When an AI agent turns a natural-language request into a SQL query and hands it to a command-line database client, an attacker can slip in a semicolon followed by their own command. Vulnerable versions of the Vanna AI toolkit (CVE-2024-7764, <=0.6.2) fail to strip this out, so the attacker's command runs instead of the intended query.

## How the attack works

An attacker crafts input that causes the AI's SQL-generation step to produce a string containing a semicolon followed by a destructive or file/OS-touching SQL statement. Vanna's extract_sql() function discards the legitimate SELECT and keeps the attacker's appended statement, and is_sql_valid() lets it through. That string is then passed to a command-line database client (psql, mysql, sqlite3, duckdb) that the agent shells out to, and the attacker's statement executes against the database.

## Why it matters

An attacker can run arbitrary database commands -- altering data, dropping tables, or reaching the file system/OS through database functions -- by hiding them inside what looks like a normal AI-generated query.

## What you can do

- Upgrade Vanna past 0.6.2 or stop passing LLM-generated SQL directly to a shell-invoked database client.
- Reject or strip any generated SQL string containing a semicolon followed by additional statements before execution.
- Run agent-generated queries through a parameterized query interface or a restricted, read-only database role instead of a full CLI client.
- Wrap any legitimate multi-statement operations (migrations, ETL) explicitly in BEGIN...COMMIT so they can be told apart from injected stacked statements.

## Known benign look-alikes

- Database migrations run as one-liners, e.g. psql -c "ALTER TABLE x ...; UPDATE y ..." -- suppressed only when explicitly wrapped in BEGIN; ... COMMIT;, so unwrapped migration one-liners will still report.
- Test-suite setup and teardown that drops or recreates scratch objects; suppressed when the object name starts with tmp/temp/test/staging/scratch/underscore, but non-conforming naming conventions will report.
- ETL and bulk-load jobs using COPY / LOAD DATA after a preparatory statement in the same inline string.
- Analytics work in duckdb or sqlite3 where an operator legitimately stacks CREATE TABLE AS ... ; SELECT ... in a single -c argument.
- dbt, Flyway, Liquibase or Alembic wrappers that shell out to a CLI client with multi-statement SQL.
- Authorised database penetration testing or a red-team exercise executed through the agent.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2024-7764
- https://owasp.org/Top10/A03_2021-Injection/

---
Source: https://www.netzilo.com/threats/vanna-sql-injection-stacked-statement